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FOREX PRIVACY POLICY (NO) 


Information on processing of personal data 
FOREX processes your personal data in 
accordance with regulation (EU) 2016/679 
(“GDPR”), lov om tiltak mot hvitvasking og 
terrorfinansiering (“Anti-Money Laundering 
Act”), forskrift om kameraovervakning i 
virksomhet (“Camera Surveillance Ordinance”) 
and other supplemental legislation such as 
loven om behandling av personopplysninger 
(“Personal Data Act”). 

Personal Data means any information 
relating to an identified or identifiable natural 
person, such as name, contact details, 
personal identification number, account 
number and other information that directly 
or indirectly can be attributed to an individual 
person. 

If you have any questions regarding our 
processing of personal data, you can contact 


us at personvernombud@forex.no. 


Why do we process your personal data and in 
which situations? 

FOREX processes personal data for several 
different purposes. The main part of our 
processing is carried out to provide the 
services you have requested, and also to carry 
out payment services and related activities. 
“Services” means for example currency 
services, online currency services, exchange 
services and other services. To be able to 
provide these services we collect and process 
the personal data that you leave when 
contacting us by for example e-mail, phone 
and visits to our store locations. 

We also collect and process personal data 
when you make an application or express 
interest in our services, and when entering 
into an agreement or in preparations thereto. 
This also includes personal data recorded 
when administering the contractual 
relationship with you, as well as other 
measures which have been taken before or 
after the conclusion of the agreement. If you 
have entered into an agreement, or in any 
other way ordered or requested any of the 
services FOREX offers, your provision of 
personal data is necessary to enter into such 
an agreement. 

We also process personal data when you 
contact us as a current customer, potential 


customer or past customer. If you are already 
a customer with FOREX you might have to 
provide additional personal data for us to be 
able to provide our services, and to be able to 
regulate our current agreement with you. 

If you have representatives, such as 
financiers, guarantors, guarantee/warranty 
holders, fiduciaries, we may have to process 
personal data regarding those individuals. 

If you call FOREX, we may record your 
phone call. In such case, you will be informed 
about this prior to recording. 

For the purpose of keeping a good 
customer maintenance and file maintenance, 
FOREX may supplement personal data by 
retrieving information from private and public 
registries, for instance by updating your 
address information using the Folkeregistret 
(“National Population Register”). 

Processing of personal data is also done to 
fulfil FOREX’s legal obligations, for example 
regarding archiving of accounting materials 
according to lov om årsregnskap m.v. 
(“Accounting Act”). 

As a currency customer, your personal data 
are processed for marketing purposes. This 
means that FOREX may send direct 
marketing, via e-mail or text messages 
regarding similar products or services. These 
contacts will take place as long as you do not 
choose to unsubscribe from receiving 
marketing. If the customer relationship 
between you and FOREX ceases, we will ask 
for your consent to be able to continue 
sending direct marketing. If you have never 
been a customer with FOREX we only send 
marketing via e-mail and text message after 
you have provided your consent. Whether or 
not you are currently a customer, you can at 
any time choose to unsubscribe from further 
marketing. For more information, see the 
section below “Unsubscribing from direct 
marketing”. 

Personal data are processed for market 
and customer analysis, used for marketing 
purposes, as well as model and business 
development and statistics. 

Personal data can also be used for direct 
marketing and communicating various offers 
via text messages and e-mail. However, you 
can choose at any time to unsubscribe from 
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future communications of this kind by 


following the link in the e-mail or by 
contacting us at info@forex.no. 
Furthermore, FOREX is in some 


circumstances obliged by law to disclose and 
otherwise process personal data in order to 
fulfil its obligations towards the authorities, 
for example Financial Supervisory Authority 
of Norway, the Norwegian Tax 
Administration, the Norwegian Labour and 
Welfare Administration, the Norwegian 
Public Service Pension Fund, police and the 
enforcement authorities, and also to comply 
with laws and regulations relating to 
accounting, anti-money laundering and 
payment services, transaction monitoring and 
fraud. In such cases, personal data are 
processed by us to be able to comply with our 
legal obligations. FOREX may check its 
customer information against sanctions lists 
that we are legally obliged or have the right to 
use to ensure that we are entitled to provide 
certain payment services. 

Personal data may also be processed in 
companies with which FOREX group 
cooperates in the provision of services. In 
such cases, personal data are processed for 
the above specified purposes. 


From where have we received your personal 
data? 

FOREX primarily processes personal data that 
you have provided us. However, in some cases 
we retrieve personal data from the National 


Population Register. The personal data 
retrieved in such cases are address 
information. 


If you do not want to provide personal data 
You are not obliged to provide personal data 
to FOREX unless it is required by an agreement 
concluded with us. If you do not want to 
provide personal data it can entail that FOREX 
will not have the possibility to provide 
services, customer service or information to 
you as a customer or when you are in contact 
with FOREX. 
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Unsubscribing from direct marketing 

At all times and free of charge, you may object 
to the processing of your personal data for 
direct marketing purposes. This applies 
regardless of whether you are a current or 
previous customer with FOREX, or if you 
otherwise have provided previous consent. 


You can unsubscribe by clicking the 
unsubscribe link in our e-mails, or by 
submitting your request to 


personvernombud@forex.no, alternatively 
by mail to FOREX Aktiebolag, Stora Nygatan 


27, 111 27 Stockholm. 

Marketing that is not direct marketing, for 
example via regular mail, may be sent to you 
regardless of whether you are a customer or 
not, provided that you have not signed up for 
a service that limits such marketing or 
otherwise declined such marketing. 


Video surveillance in our offices 

Both your and our staff’s security is important 
to us, and therefore we have chosen to use 
video surveillance in our offices. The recorded 
material is only used to pre-empt, prevent and 
investigate crime and suspicions of crime. The 
material may be provided to the police and 
prosecutor authorities. 

The recordings take place 24 hours a day, 
and in specific cases sound is also recorded. 
The material is saved for 30 days. FOREX 
records and manages the recorded material in 
compliance with the GDPR, the Camera 
Surveillance Ordinance and the Personal Data 
Act. The legal basis for the storage is our 
legitimate interest, as we have carefully 
considered that your interests, fundamental 
rights and freedoms which require protection 
of personal data does not override our 
legitimate interest in this case. 


Currency customers — for you who order 
currency, exchange money, or use our 
currency services 

As a currency customer, FOREX may ask for 
your contact information such as e-mail 
address and phone number. You can choose if 
you want to provide contact information, and 
which categories of information you want to 
provide. If we ask for your consent in one of 
our store locations, you will at the same time 
receive information regarding the purposes 
and means of the processing of personal data. 
The contact information you provide us can 
be used to reach you with information 
regarding the service you want to utilise. The 
contact information may also be used for 
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direct marketing and offers via e-mail and text 
message concerning similar products or 
services from FOREX. These communications 
will occur if you do not unsubscribe from 
further marketing actions. 

At our exchange store locations you can, 
among other things, buy and sell currency. If 
you want to perform a single or several 
separate transactions with us, or if you 
otherwise want to initiate a business 
connection with FOREX, we may have to verify 
your identity, age and who your principal is. 
For example, according to the Anti-Money 
Laundering Act we are obligated to identify 
our customers and verify their identity when 
establishing a permanent customer 
relationship. The same obligation applies for 
single transactions that exceed the thresholds 
mentioned in the fifth chapter of the Anti- 
Money Laundering Act, or single transactions 
where we suspect or have reasonable 
grounds to suspect that the transaction is a 
part of money laundering or financing of 
terrorism, which we are obligated to report 
according to the Anti-Money Laundering Act. 
Suspected transactions mean for instance 
transactions of exceptionally high value. 

Furthermore, we might have to check if 
you are a politically exposed person, in which 
country your business is established, check 
information against European sanctions lists 
and retrieve information about the purpose 
and nature of the business connections. 
FOREX is obligated to take these measures, as 
a part of our work against risks for money 
laundering, against financing of terrorism, and 
to comply with the requirements of customer 
knowledge and customer relations as 
stipulated in the Anti-Money Laundering Act. 
FOREX’s legal obligations emanating from the 
Anti-Money Laundering Act and applicable 
legislation regarding money laundering serves 
as the legal basis for this processing of your 
personal data. 

You are not obliged to provide personal 
data to us, but if you choose not to do so it can 
entail that FOREX will not have the possibility 
to provide currency services. When assessing 
risks and deviations of transactions FOREX 
may be obligated to report to the National 
Authority for Investigation and Prosecution of 
Economic and Environmental Crime 
(Økokrim). Any data provided in such 
reporting will be classified. 

FOREX may request that you show an ID to 
verify your age — we do not have the 
possibility to enter into agreements with 
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persons under 16 years of age (Sweden and 
Norway), and persons under 15 years of age 
(Finland and Denmark). 


Automated decision-making and profiling 
For marketing purposes, FOREX will process 
personal data of currency exchange 
customers and other customers such as those 
who made currency reservations or have 
requested or utilised our services. Such 
processing of personal data is in part done by 
internal categorisation and analysis of 
customer groups and overall consumer and 
customer behaviour in general. 

In addition, profiling (automated 
processing of personal data to evaluate 
personal aspects) is conducted to form 
supporting data and statistical conclusions 
regarding customer analysis for marketing, 
method and business development. Personal 
data processed are those submitted by 
yourself to FOREX and supplementary data 
from public registries such as the National 
Population Register and other government 
agencies as well as financial institutes. As a 
result of profiling, you may receive tailored 
marketing communications. At any time, you 
have the right to object to the continued 
profiling and processing of your personal data 
for direct marketing purposes. You can do 
that by contacting us at info@forex.no at or 
by clicking the link in the marketing e-mails 
you have received. 


Legal basis for processing of personal data 

If FOREX processes your personal data to be 
able to provide our services it is done to the 
extent this is necessary for the performance 
of a contract to which you are a party or in 
order to take steps prior to entering into a 
contract at your request. 

In addition, personal data are processed 
when it is necessary for compliance with 
FOREX’s legal obligations, e.g. fulfilling 
obligations towards the Financial Supervisory 
Authority of Norway, the Norwegian Tax 
Administration, police or enforcement 
authorities. Such instances may relate to our 
legal obligations relating to accounting, anti- 
money laundering, combating the financing of 
terrorism, as well as applicable legislation 
regarding payment services, monitoring of 
transactions and fraud control. 

In case you have explicitly given your 
consent to FOREX’s processing of your 
personal data for one or several specific 
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purposes, such consent will form the legal 
basis for processing of your personal data. If 
we ask for your consent, you will receive 
specified information regarding the 
processing subject to your consent and on 
what your consent entails. 

To the extent FOREX processes personal 
data more extensively than necessary for the 
purposes of performance of a contract or to 
comply with legal obligations, and the 
processing is not based on consent, the legal 
basis for such processing is FOREX’s legitimate 
interests. FOREX has identified a legitimate 
interest for which the processing of personal 
data is necessary, and after careful 
assessment considered that your interests, 
fundamental rights and freedoms do not 
override FOREX’s legitimate interests in such 
cases and do not require protection of 
personal data. FOREX has a legitimate interest 
to conduct market and customer analyses, 
prepare marketing activities, model and 
business development, statistics and to 
conduct direct marketing. In cases where 
personal data are processed in the context of 
such activities, FOREX’s legitimate interests 
form the legal basis for such processing 
necessary for purposes of FOREX’s legitimate 
interests as above. 


Withdraw consent 

If FOREX processes your personal data based 
on your explicit consent, you have the right to 
withdraw such consent at any time. To do so, 
please inform us that you no longer accept 
the processing of your personal data based on 
your consent. However, such withdrawal of 
consent does not affect the lawfulness of 
processing based on consent before its 
withdrawal. 


Recipients of personal data 

For the personal data disclosed by you and 
gathered from public registries to supplement 
data, FOREX is the main party receiving and 
processing personal data. In addition, the 
following categories of recipients may also 
receive personal data in some cases: a) 
authorities in Denmark and abroad to whom 
FOREX is legally obligated to disclose 
information as described above, b) companies 
with which the FOREX group cooperates to 
provide its services. 

Transfer of personal data outside EU/EEA 
Under certain circumstances, FOREX is 
obliged to transfer personal data abroad and 
outside the EU/EEA, in cooperation with 
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government authority. In addition, such 
personal data may be transferred to to a 
company with which FOREX cooperates to 
provide its services. 

In cases where FOREX is controller of data 
to be transferred outside the EU/EEA, such 
transfers are made in compliance with the 
GDPR, and other supplementary legislation 
such as the Data Protection Act, to ensure 
equivalent protection of personal data. This 
means that either, there exists a decision by 
the EU Commission on the third country in 
question and its ensuring of adequate level of 
data protection, or that other appropriate 
safeguards are in place in that the recipient of 
personal data in a third country is subject to 
standard data protection clauses or binding 
corporate rules. In the absence of above- 
mentioned grounds for transfer, FOREX will 
obtain a specific authorization from the 
competent supervisory authority or, 
alternatively, your explicit consent to the 
transfer of personal data. If we ask for your 
consent for such transfer, you will be 
informed of any possible data protection risks 
of the transfer. If you wish to receive 
additional information on the safeguards 
applicable to the transfer of your personal 
data outside the EU/EEA, please contact 


personvernombud@forex.no. 


For how long is my personal data stored? 
How long your personal data will be stored 
depends on the purpose of the processing. 

If you are a customer, FOREX will retain 
your personal data if you remain our 
customer, i.e. as long as the agreement 
between you and FOREX remains valid. At the 
end of the customer relationship and upon 
agreement termination, your data will be 
retained by FOREX five more years, in order to 
manage legal claims and to exercise our rights 
and fulfil our obligations in relation to 
potential claims and inquiries by former 
currency exchange and in relation to 
authorities. 

However, the processing of the personal 
data will only continue as long there is a legal 
basis for it. FOREX is required to process some 
personal data to address obligations in 
relation to authorities such as the Financial 
Supervisory Authority of Norway, the 
Norwegian Tax Administration, police and the 


enforcement authorities, and to ensure 
compliance with rules pertaining to 
accounting, anti-money laundering and 


combating the financing of terrorism and 
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applicable payment services legislation, 
transaction monitoring, and fraud. Due to 
these regulatory requirements, we are 
obligated to retain personal data also when 
you are no longer our customer. For the above 
reasons, your data will be retained for a 
maximum period of 10 years after the 
agreement has terminated and your customer 
relationship with FOREX ceased. 

If you contact FOREX but do not enter into 
an agreement with us, your personal data will 
generally be retained for a maximum period of 
three months but may be stored further due 
to obligations under the Anti-Money 
Laundering Act. This processing is based on 
our and your legitimate interest of facilitating 
further contact. For instance, your account 
application may have been refused and you 
want to provide a new application within a 
short period of time. FOREX has, after careful 
assessment considered that your interests, 
fundamental rights and freedoms do not 
override FOREX’s legitimate interest in such 
cases and do not require protection of 
personal data. To facilitate this process, the 
processing of personal data is necessary, and 
FOREX has after careful assessment 
considered that your interests, fundamental 
rights and freedoms do not override this 
legitimate interest. 

Regarding personal data deriving from a 
scanned ID, for example name and 
identification number, such personal data will 
not be retained if the exchange transaction 
does not exceed the threshold. Exceptions to 
this main rule can be made if the ID is deemed 
to be invalid or is suspected to be fake. In such 
a case a copy of the ID will be stored for a 
maximum of 30 days before it is deleted. The 
purpose of such processing is that we have to 
be able to provide a copy of the ID to the 
police, if there is a suspected crime according 
to the Anti-Money Laundering Act. The legal 
basis for the storage is the necessity for us to 
comply with our legal obligations. 

When in contact with customer service and 
if you have accepted that your phone call will 
be recorded, any such recording will be 
retained for a maximum period of three 
months. The legal basis for the processing of 
this personal data is FOREX’s legitimate 
interests, as FOREX has a legitimate interest to 
process the sound file for education purposes 
and to develop customer service. FOREX has 
after careful assessment considered that your 
interests and fundamental rights do not 
override FOREX’s legitimate interests in this 
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particular case and do not require protection 
of personal data. 


Your rights 
If FOREX processes your personal data, you 
have several rights according to the GDPR. 


You have the right to request a register 
extract, free of charge, containing a summary 
of your personal data processed by FOREX 
along with information on how such data is 
processed. To verify your identity, a registry 
extract will be sent to you by registered mail. 


In addition, you have the right to request 
rectification, which means that we adjust 
inaccurate personal data. 


In some circumstances you have a right to 
erasure, which means that we erase personal 
data where the processing of such data is no 
longer necessary. 


You also have a right to request restriction 
of processing, which means that we restrict or 
limit the processing in some respects. 


Furthermore, you may request data 
portability, meaning that you request that we 
provide personal data provided by you to 
FOREX in a structured, commonly used and 
machine-readable format if you wish to 
transmit those data to another controller. 


Data controller 

For all your personal data being processed, 
the data controller is FOREX Norge: 

FOREX, subsidiary of FOREX AB Sverige (org. 
nr: 985 090 882). Address: Storgata 10A, 0155 
Oslo. E-mail address: 
personvernombud@forex.no. Web site: 
www.forex.no. Phone number: +46 (0)10-211 
10 00. 


Data Protection Officer 

FOREX has appointed a Data Protection 
Officer to oversee and make sure that all 
processing of personal data is compliant with 
the GDPR and supplementary legislation. 

If you are unable to find the information 
you are looking for in this Privacy Policy, or if 
you otherwise have questions on how FOREX 
processes your personal data, you can 
contact our data protection officer at e-mail 


personvernombud@forex.no or by phone at 
+46 (0)10-211 10 00. 


FOREX 


Complaints to the Norwegian Data 
Protection Authority 

The Norwegian Data Protection Authority is 
the relevant authority responsible for the 
supervision of compliance of the GDPR. If you 
believe that FOREX processes personal data in 
violation of GDPR or other applicable 
legislation, you can lodge a complaint to the 
Norwegian Data Protection Authority via 
www.datatilsynet.no or by phone +47 22 39 
69 00. 
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